Privacy Policy

This Policy applies to the Footlads mobile application. It is intended for users in Nepal. It does not cover the practices of third parties whose services we rely on (such as Google or Amazon Web Services); those parties handle data under their own privacy policies, which we link to where relevant.

We collect only the information needed to run the service. We do not collect your date of birth, gender, or postal address as part of your account.

a. Account information: When you register, we collect your first name, last name, email address, phone number, and a password. Your password is stored only in an irreversible hashed form that we cannot read. This information is used to create and secure your account, identify you to organisers when you book, and display your name in game and chat screens.

b. If you sign up with Google: If you choose to sign in with Google, Google confirms your verified email address to us. We do not receive your Google password. Your account is then created the same way as above.

c. Verification and login security: To verify your email or phone and to alert you to new sign-ins, we generate one-time codes and record basic device information, namely your device model, brand, and platform (for example, “Android Samsung”). We use this to send you a security alert when your account is accessed from a device, so you can spot unauthorised access. We do not collect or store your IP address, precise location, or browsing history on your session record.

d. Location: When you search for games or venues near you, the App uses your device’s location on the device itself to sort results, and this precise location is not sent to or stored by us. When you type a place into the location search box, that text is sent to Google’s Places service to return address suggestions (see Section 4). Venue and game addresses that organisers publish are stored and shown publicly so others can find them.

e. Bookings and content you create: When you book a venue or join a game, we store the booking details, any notes you add, and, where relevant, a payment reference number you type in yourself (see “A note on payments” below). We also store chat messages you send in a game room, which are visible to others in that game, and any games or venues you create.

f. Notifications: To send you push notifications about your bookings and games, we store a push-notification token for your device provided by Google’s Firebase Cloud Messaging.

g. Analytics and crash data: We use Google Firebase Analytics and Crashlytics to understand how the App is used and to diagnose crashes. This records app events (such as screens viewed and actions taken), and Google automatically collects your device model, operating system, app version, and approximate location derived from your IP address. Your activity is linked to an internal account identifier, not to your email. This helps us improve the App.

h. Verification documents: To verify your identity, you may send us an identity document by email. If you list a venue, you may also send us documents relating to that venue. We use these only to confirm that you are a real person and, for venues, that you are entitled to list the venue. We store them securely with restricted access, and we delete them when they are no longer needed or on your request.

Footlads does not process payments and never holds your money. We are not a payment service. When you pay for a booking, you pay the organiser directly, outside the App, using whatever method you and the organiser arrange. We do not collect or store your card details, bank details, or any payment credentials, and we have no payment gateway.

The only payment-related information we hold is what an organiser records for their own bookkeeping (for example, marking a booking as paid), and an optional reference number you may type in as proof of a transfer you made. This is a plain piece of text; it is not verified by us and is shared only with the organiser for that booking.

We do not sell your personal information. We share it only in the ways described here.

a. Organisers and other users: When you book a venue or join a game, the organiser receives your name and the contact details needed to reach you about that booking. Other players in a game can see your name and any chat messages you send.

If you list a venue or host a game as an organiser, your name and contact details (email and phone) are shown to users who view your venue or game. This is intentional, so players can contact you directly to arrange or resolve a booking, which is how bookings often work in practice.

b. Service providers we rely on: We use trusted third-party services to run the App. Each handles data under its own privacy policy:

• Amazon Web Services (AWS): hosts our servers, database, and stored images, and sends our emails.
• Google Firebase: sign-in, push notifications, analytics, and crash reporting.
• Google Places: turns the text you type in the location box into address suggestions.

c. Cross-border transfer: Some of these providers store and process data on servers located outside Nepal (for example, AWS in Mumbai, India, and Google’s global infrastructure). By using the App and agreeing to this Policy, you consent to your information being transferred and processed outside Nepal for the purposes described here. We rely on these providers’ own security measures to protect your data in transit and at rest.

d. Legal disclosure: We may disclose your information where required to do so by law, or in response to a valid request from a competent authority.

Your information is protected using encryption in transit and at rest, and access to it is restricted. No system can be guaranteed completely secure, but we take reasonable steps to safeguard your data.

We keep your account information for as long as your account exists. One-time verification codes are deleted automatically a short time after they expire. Inactive login sessions are removed automatically after 30 days. Other records you create, such as bookings, games, and chat messages, are kept while your account is active, and can be removed on request as described below.

Under the Individual Privacy Act, 2075, you have the right to access the personal information we hold about you, to ask us to correct it if it is wrong, and to ask us to delete it.

To request access, correction, or deletion of your data, email us at [email protected], or see our data-deletion page at footlads.com/data-deletion. We handle deletion requests manually and will remove your personal data from our systems, including data held with the third-party services listed above where applicable. Some records may be retained where we are required to keep them by law.

Footlads is not intended for children under 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us and we will remove it.

We may update this Policy from time to time. When we make a significant change, we will update the effective date at the top and, where appropriate, ask you to review and accept the updated Policy. Your continued use of the App after a change means you accept the updated Policy.

If you have any questions about this Policy or how we handle your information, contact us at [email protected].